Windows Imaging Component CVE-2026-54984

Exploitation requires that a local user on the target system open, preview, or otherwise cause Windows Imaging Component to parse a specially crafted image file, as confirmed by the UI:R CVSS metric. The attack vector is local (AV:L), meaning the malicious file must reach the target system through a delivery mechanism such as phishing email, malicious website download, removable media, or network share - the attacker does not directly network-connect to WIC. No prior authentication or elevated privileges are required from the attacker (PR:N); the victim need only be a standard user. Exploitation is limited to unpatched Windows versions within the confirmed build ranges. Server deployments that do not process user-supplied images or allow interactive logon have significantly reduced realistic exposure. The unchanged scope (S:U) means impact is confined to the security context of the user or process that triggers WIC parsing - a standard user execution does not automatically escalate to SYSTEM.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity local code execution flaw with no privilege prerequisite but mandatory user interaction, consistent with a file-lure delivery mechanism. The low attack complexity (AC:L) is notable: once the user opens the crafted image, exploitation does not require precise timing or non-default conditions, making reliable exploitation more accessible to less sophisticated adversaries. No CISA KEV listing is present in the provided data and no POC is referenced, which moderates immediate crisis-level response, but heap overflows in widely-invoked image parsers are historically reliable exploit targets, and the absence of KEV should not be read as absence of attacker interest. The affected surface is extraordinarily broad - 19 distinct Windows product/version combinations confirmed by EUVD-2026-56301, spanning legacy Server 2012 through modern Server 2025 - meaning even a mid-sized municipal IT team in walbrzych managing a heterogeneous Windows fleet should treat this as an urgent patch cycle rather than a deferred backlog item. The local attack vector limits opportunistic mass exploitation compared to a network-reachable flaw, but reduces risk only modestly in enterprise environments where users regularly open email attachments and downloaded files, both of which trigger WIC processing.

An attacker delivers a specially crafted image file - such as a malicious TIFF, ICO, or BMP - to a target user via a phishing email or a compromised file share. When the user opens or simply browses to the file in Windows Explorer (triggering thumbnail generation), Windows Imaging Component parses the image and the heap buffer overflow is triggered, allowing the attacker to overwrite adjacent heap memory and redirect execution to attacker-controlled shellcode running in the user's security context. No public exploit code is known at time of analysis, but the exploit class (heap overflow in a file parser) is well-understood and historically reliable.